您好,欢迎访问一九零五行业门户网

php防sql注入数据model类

exec(set names .db_charset); 
$this->pob=$pdo; 

/* 
* 作用:增 
* 参数:array $arr exp:array('字段名'=>值,'字段名'=>值,....) 
* return:int|false 
*/ 
function add($arr){
//拼sql语句 
$karr=array_keys($arr); 
$kstr=join(,,$karr); 
$varr=array_values($arr);
$pstr = ''; 
foreach ($varr as $s=>$y){ 
$vname = p.$s; 
$pstr.=':'.$vname.','; 

$pstr = substr($pstr,0,-1);
$sql = insert into {$this->tablename}($kstr) values($pstr);
print_r($sql); 
$pdos = $this->pob ->prepare($sql); 
foreach ($varr as $k=>$y){ 
$vname = p.$k; 
$$vname = $y; 
var_dump($vname,$$vname); 
$pdos -> bindparam(:.$vname, $$vname,pdo::param_str);

$re = $pdos -> execute(); 
if($re){//添加成功 
//返回主键id值 
return $this->pob->lastinsertid(); 

//返回值 
return $re;

public function delete($arrwhere){ 
if(!empty($arrwhere)){ 
$strw = where ; 
foreach($arrwhere as $kw=>$vw){ 
$kn = str_replace(:, , $kw); 
if(count($arrwhere)==1){ 
$strw .= $kn.=.$kw; 
}else{ 
$strw .= $kn.=.$kw. and ; 
}

if(count($arrwhere)>1){ 
$strw .= 1=1 ; 
}

$sql = delete from {$this->tablename}.$strw; 
print_r($sql); 
$pdos = $this->pob->prepare($sql); 
foreach ($arrwhere as $kw=>$vw){ 
$kn = str_replace(:, , $kw); 
$$kn = $vw; 
if(is_int($vw)){ 
$pdos->bindparam($kw,$$kn,pdo::param_int); 
}else if(is_float($vw)){ 
$pdos->bindparam($kw,$$kn,pdo::param_int); 
}else{ 
$pdos->bindparam($kw,$$kn,pdo::param_str); 
}

$re=$pdos->execute(); 
if($re){ 
    return true; 
}else { 
return false; 
}

function update($arrset,$arrwhere){ 
//拼sql语句
$str = ; 
$n=0; 
foreach ($arrset as $ks=>$vs){
$str .= ,.$ks.=:p.$n++; 

$str = substr($str, 1);
foreach($arrwhere as $kw=>$vw){ 
$kn=str_replace(:,,$kw);
if(count($arrwhere)==1){ 
$strw .= $kn.=.$kw; 
}else{ 
$strw .= $kn.=.$kw. and ; 
}
}
if(count($arrwhere)>1){ 
$strw .= 1=1 ; 
}
$sql=update {$this->tablename} set {$str} where .$strw; 
//print_r($sql);
$pdos=$this->pob->prepare($sql); 
$x = 0; 
foreach($arrset as $ks=>$vs){
$ks = :p.$x++; 
$$ks = $vs;
if(is_int($vs)){ 
$pdos->bindparam($ks,$$ks,pdo::param_int); 
}else if(is_float($vs)){ 
$pdos->bindparam($ks,$$ks,pdo::param_int); 
}else{ 
$pdos->bindparam($ks,$$ks,pdo::param_str); 

}
foreach($arrwhere as $kw=>$vw){ 
$kn=str_replace(:,,$kw); 
$$kn=$vw;//$p0  $p1 $p2 
if(is_int($vw)){ 
$pdos->bindparam($kw,$$kn,pdo::param_int); 
}else if(is_float($vw)){ 
$pdos->bindparam($kw,$$kn,pdo::param_int); 
}else{ 
$pdos->bindparam($kw,$$kn,pdo::param_str); 


$re=$pdos->execute(); 
if($re){ 
    return true;
}else{ 
return false; 
}

//查 
function select($field=*,$arraywhere=,$order=,$limit=){ 
if(!empty($arraywhere)){ 
$strw = where ; 
foreach($arraywhere as $kw=>$vw){ 
$kn=str_replace(:,,$kw);
if(count($arraywhere)==1){ 
$strw .= $kn.=.$kw;
}else{ 
$strw .= $kn.=.$kw. and ; 
}
}
if(count($arraywhere)>1){ 
$strw .= 1=1 ; 
}

if(!empty($order)){ 
$order=order by .$order; 

if(!empty($limit)){ 
$limit=limit .$limit; 
}
//select 字段列表 from 表名 where 条件 order by 字段 desc|asc limit start,length; 
$sql=select {$field} from {$this->tablename} {$strw} {$order} {$limit}; 
//print_r($sql); 
$pdos=$this->pob->prepare($sql); 
if(!empty($arraywhere)){ 
foreach($arraywhere as $kw=>$vw){ 
$kn=str_replace(:,,$kw); 
$$kn=$vw; 
if(is_int($vw)){ 
$pdos->bindparam($kw,$$kn,pdo::param_int); 
}else if(is_float($vw)){ 
$pdos->bindparam($kw,$$kn,pdo::param_int); 
}else{ 
$pdos->bindparam($kw,$$kn,pdo::param_str); 



$re=$pdos->execute(); 
if($re){ 
$pdos->setfetchmode(pdo::fetch_assoc); 
return $pdos->fetchall(); 
}else { 
return false; 
}
}
}
其它类似信息

推荐信息